Responsive data tables
Hiding a table column does not restrict its data
Review the server response, exports and row actions as well as visible columns. Responsive presentation is not an authorisation boundary.
In this article
Inspect what reaches the browser
A mobile layout may hide financial or personal columns for space, while the API still returns them. That is acceptable only if the user is authorised to receive the data in the first place.
Apply field and record access rules at the server. Do not rely on CSS visibility, a column picker or a disabled row action to protect information.
Review prefetches and detail requests too. A restricted value can arrive through a cached record even when the main list endpoint omits it.
Treat exports as a separate action
Define whether an export includes the visible page, selected records or all filtered results. State its scope and apply current permissions when generating it.
A user allowed to inspect a small operational queue may not automatically be allowed to download the entire customer dataset. The business should decide that capability explicitly.
Keep exported files under an appropriate access and expiry policy. A secure table followed by a publicly accessible download link defeats the original restriction.
Validate bulk actions against current records
Send stable record identities or a carefully defined query selection contract. The server must recheck authority and eligibility at execution time.
For an illustrative case, a selected job moves to another team after the list loads. The user should not retain update authority merely because its checkbox remains selected in stale client state.
Report partial outcomes accurately. If some records are rejected, identify them through an authorised result and preserve enough context for the user to understand what happened.
Test organisational boundaries and cached views
Use synthetic accounts from two organisations and attempt direct record fetches, exports and bulk updates across their boundary. Change accounts in the same browser and confirm that cached rows do not appear under the new session.
Inspect URL state for sensitive information. Filters can be shareable without placing private free-text contents or credentials in a link that may enter logs and browser history.
Keep diagnostic telemetry limited to useful query and state evidence. Recording full table payloads on every rendering error can create an unnecessary copy of the dataset.
Primary sources
W3C APG: table patternReferences checked 11 September 2026.